Principal Cyber Security Specialists

The Department of Social Services (DSS) is seeking two Senior Cyber Security Specialists to join the Department’s Cyber, Risk and Assurance function and to provide authoritative cyber security advice and senior delivery support to the Director, Cyber, Risk and Assurance and the Chief Information Officer, who is also the Department’s Chief Information Security Officer and Artificial Intelligence, Accountable Official. DSS operates through a managed service ICT model. Services Australia provides most managed ICT and operational cyber security capabilities, including cyber security operations, monitoring and detection, operational incident response, vulnerability and patch-management services, coordination of penetration testing and other security testing, and technical implementation of security controls expected in standard ICT and cyber security function. DSS nevertheless retains accountability for its cyber risks and outcomes and cannot transfer its responsibility for informed risk ownership, governance, assurance and decision making to Services Australia as its service provider. The specialists will strengthen DSS’s internal cyber security function and its ability to understand, govern, direct and assure cyber security across a complex enterprise and managed service environment. They will operate on DSS’s behalf as informed and technically credible cyber advisers by reviewing assurance evidence, constructively challenging advice, assessing risk, supporting decisions and providing advice on responsibilities that must remain with the Department. The roles require substantial contemporary cyber security experience and broad knowledge across security governance, risk and assurance; enterprise and security architecture; cloud security; artificial intelligence and emerging technology risks; identity and privileged access; vulnerability and exposure management; monitoring and threat detection; incident governance and resilience; data protection; application and infrastructure security; accreditation; and Australian Government security requirements. These are not compliance only, audit coordination or high level security documentation or review roles. Successful candidates must be able to examine complex technical and operational issues, identify material security implications, assess whether controls, evidence and proposed treatments are credible, and translate findings into practical advice for technical teams, system owners, executives and the Director, Cyber, Risk and Assurance and CIO/CISO/CAIO. Candidates are not expected to perform day-to-day cyber engineering, penetration testing or security operations. They must, however, be sufficiently technically credible to interpret and challenge operational and architectural advice, vulnerability data, security testing outcomes, logging and monitoring information, incident advice and control evidence. The specialists will work with limited supervision, deliver at pace across competing priorities and provide immediate expert capacity while DSS rebuilds its APS cyber workforce. They will work collaboratively with the EL2 Director, Cyber, Risk and Assurance, the DSS ICT Program Management Office, APS employees, business and system owners, project teams, Services Australia and other delivery partners, including key security agencies as required. An important outcome of the engagement is sustainable internal capability. The specialists will mentor APS employees, transfer knowledge, improve policies and processes, develop reusable artefacts and help establish effective ways of working that reduce long term reliance on external resources. DSS is seeking two specialists with broad cyber security capability. Candidates may bring deeper expertise in particular areas, including: enterprise cyber risk, assurance, accreditation, security policy and Australian Government security requirements; or ITSA/CISO advisory, security architecture, cloud and AI security, vulnerability and threat assessment, incident governance and technical assurance. All candidates must nevertheless demonstrate sufficient breadth, judgement and technical credibility to operate effectively across the end-to-end cyber security domain within the Commonwealth Government ICT environment. Key duties and responsibilities The Senior Cyber Security Specialists will: provide authoritative cyber security advice to the Director, Cyber, Risk and Assurance and the CIO/CISO on strategic, technical, operational, risk, threat, assurance and compliance matters support DSS as the accountable risk owner by reviewing, interpreting and constructively challenging cyber security advice, evidence, reporting and recommendations provided by Services Australia and other delivery partners lead or support cyber security risk assessments, control assessments, system security plans, security assessment reports, system authorisation packages, risk acceptance briefs, exemptions, improvement and remediation plans and other assurance artefacts assess the security implications of cloud services, artificial intelligence, automation and other emerging technologies, including security architecture, data protection, identity, access, logging, monitoring and control requirements provide cyber security advice on enterprise and solution architecture, secure-by-design proposals, identity and privileged access, applications, infrastructure, cloud, data protection and technology implementation decisions assess vulnerabilities, CVEs, vulnerability-scanning results, penetration-testing findings, threat information, control deficiencies and remediation proposals from a DSS risk and assurance perspective review logging, SIEM, monitoring, detection and other operational cyber information to identify material risks, evidence gaps and matters requiring escalation or further assurance provide security advice to ICT and cyber projects, procurements, business areas and system owners, including security requirements, design reviews, assurance planning, risk assessments and proportionate treatment options support DSS’s organisational cyber incident governance role, including risk assessment, executive advice, coordination, escalation, communications, recovery priorities, lessons learned and assurance of the service-provider response review, update and improve DSS cyber security policies, standards, procedures, templates, playbooks, reporting products and guidance interpret and apply the PSPF, ISM, Essential Eight (ASD Essentials) and other relevant ASD and Australian Government security guidance support DSS responses to the ASD Cyber Security Survey and other compliance, assurance, audit and reporting requirements improve cyber risk registers, control libraries, assurance plans, compliance tracking, vulnerability registers and executive and committee reporting support clear and timely decisions on risk ownership, acceptance, treatment, escalation and monitoring clarify DSS and service-provider responsibilities, identify gaps in accountability or evidence, and support effective governance of shared cyber security outcomes support implementation and assurance of the new DSS Cyber Strategy, Digital Investment Plan and cyber uplift priorities build effective relationships across DSS, Services Australia, other providers and relevant Australian Government stakeholders communicate complex cyber security issues clearly to executives, business owners, system owners, architects and technical teams mentor APS employees and transfer knowledge through coaching, practical collaboration, documentation and reusable guidance capture lessons from incidents, risk assessments, accreditation activities, vulnerability reviews, projects and assurance engagements translate lessons learned into improved policies, controls, procedures, templates, reporting and future delivery approaches provide clear handover material covering completed work, outstanding risks, dependencies, recommendations and next actions. Criteria The buyer has specified that each candidate must provide a response to each criterion. Each response is limited to 3000 characters. Essential criteria Weighting 1. Significant demonstrated contemporary experience as a senior cyber security practitioner, with broad and current knowledge across enterprise security architecture, cloud, AI and emerging technologies, identity, vulnerability management, monitoring and detection, incident response, resilience, data protection and application security. Candidates must demonstrate an ability to interrogate technical evidence, identify material weaknesses and provide authoritative risk-based advice. Compliance only or audit administration experience will not be sufficient. Weighting: 30% 2. Demonstrated experience delivering complex cyber risk assessments, control assessments, system authorisation activities, security plans, risk acceptances, exemptions, treatment plans and assurance outcomes, including practical application of the PSPF, ISM, Essential Eight and relevant ASD guidance. Weighting: 25% 3. Demonstrated ability to analyse complex strategic, technical and operational cyber issues and provide clear, practical and defensible advice to a ITSA/CISO, senior executives, governance committees and risk owners. Weighting: 20% 4. Demonstrated ability to operate effectively in a managed, shared service, outsourced or multi-provider ICT environment, including clarifying accountabilities, assessing provider evidence, challenging advice and supporting informed organisational risk decisions. Weighting: 15% 5. Demonstrated ability to work with limited supervision, deliver at pace across competing priorities, communicate effectively with technical and non-technical stakeholders, mentor internal staff and create reusable artefacts that build sustainable organisational capability. Weighting: 10% Desirable criteria 1. Experience delivering cyber security outcomes within an Australian Government department at the PROTECTED level or higher. 2. Relevant tertiary qualifications or recognised professional certifications such as CISSP, CISM, CRISC, CCSP, SABSA, ISO 27001 or equivalent. Qualifications will be considered alongside, and will not substitute for, demonstrated practical capability. Opportunity summary Sellers can submit Up to 3 candidates Number of sellers invited More than 10 Number of candidates submitted Fewer than 10 RFQ closing time 01 Weeks 04 Days 06 Hours Send us feedback About Accessibility Privacy Terms of use Disclaimer and copyright An initiative of the Digital Transformation Agency The Australian Government acknowledges the Traditional Owners of Country throughout Australia and acknowledges their continuing connection to land, waters and community. We pay our respects to the people, the cultures and the Elders past and present. © Commonwealth of Australia